Azure-Sentinel/Workbooks/F5BIGIPSystemMetrics.json

1450 строки
47 KiB
JSON

{
"version": "Notebook/1.0",
"items": [
{
"type": 1,
"content": {
"json": "## F5 BIG-IP System Metrics"
},
"name": "text - 2"
},
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"crossComponentResources": [
"{Workspace}"
],
"parameters": [
{
"id": "2cb5690b-61f2-47f0-a020-5c59e6783621",
"version": "KqlParameterItem/1.0",
"name": "DefaultSubscription_Internal",
"type": 1,
"isRequired": true,
"query": "where type =~ 'microsoft.operationalinsights/workspaces'\r\n| take 1\r\n| project subscriptionId",
"crossComponentResources": [
"value::selected"
],
"isHiddenWhenLocked": true,
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources"
},
{
"id": "77b8a63c-f0cd-475f-ad87-7939d8c13547",
"version": "KqlParameterItem/1.0",
"name": "Subscription",
"type": 6,
"isRequired": true,
"query": "summarize by subscriptionId\r\n| project value = strcat(\"/subscriptions/\", subscriptionId), label = subscriptionId, selected = iff(subscriptionId =~ '{DefaultSubscription_Internal}', true, false)\r\n",
"crossComponentResources": [
"value::selected"
],
"typeSettings": {
"additionalResourceOptions": [
"value::1"
]
},
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources"
},
{
"id": "0565232c-bc82-44db-ac13-b9d7c1a90348",
"version": "KqlParameterItem/1.0",
"name": "Workspace",
"type": 5,
"isRequired": true,
"query": "where type =~ 'microsoft.operationalinsights/workspaces'\r\n| project id",
"crossComponentResources": [
"{Subscription}"
],
"value": "",
"typeSettings": {
"additionalResourceOptions": []
},
"timeContext": {
"durationMs": 0
},
"timeContextFromParameter": "TimeRange",
"queryType": 1,
"resourceType": "microsoft.resourcegraph/resources"
},
{
"id": "5273ece9-ebfd-479f-9d94-1463360b302a",
"version": "KqlParameterItem/1.0",
"name": "HostName",
"label": "Host Name",
"type": 2,
"isRequired": true,
"query": "F5Telemetry_AVR_CL\r\n| distinct hostname_s",
"crossComponentResources": [
"{Workspace}"
],
"value": "",
"typeSettings": {
"additionalResourceOptions": []
},
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
{
"id": "f260e834-0fd6-4d4f-8741-4cb24968a0c3",
"version": "KqlParameterItem/1.0",
"name": "TimeRange",
"type": 4,
"isRequired": true,
"value": {
"durationMs": 14400000
},
"typeSettings": {
"selectableValues": [
{
"durationMs": 300000
},
{
"durationMs": 900000
},
{
"durationMs": 1800000
},
{
"durationMs": 3600000
},
{
"durationMs": 14400000
},
{
"durationMs": 43200000
},
{
"durationMs": 86400000
},
{
"durationMs": 172800000
},
{
"durationMs": 259200000
},
{
"durationMs": 604800000
},
{
"durationMs": 1209600000
},
{
"durationMs": 2419200000
},
{
"durationMs": 2592000000
},
{
"durationMs": 5184000000
},
{
"durationMs": 7776000000
}
],
"allowCustom": true
},
"resourceType": "microsoft.insights/components",
"label": "Time Range"
},
{
"id": "2af8b5f6-7703-49f7-b970-e004a1a4c4f1",
"version": "KqlParameterItem/1.0",
"name": "SamplePeriod",
"label": "Sample Rate",
"type": 2,
"isRequired": true,
"typeSettings": {
"additionalResourceOptions": []
},
"jsonData": "[\r\n { \"value\": \"m\", \"label\": \"Minute(s)\", \"selected\":true },\r\n { \"value\": \"h\", \"label\": \"Hour(s)\" },\r\n { \"value\": \"d\", \"label\": \"Day(s)\" }\r\n]",
"resourceType": "microsoft.insights/components"
},
{
"id": "8e2d5a7c-a59e-4768-acb6-553494d132fd",
"version": "KqlParameterItem/1.0",
"name": "SampleValue",
"label": "Rate Value",
"type": 2,
"isRequired": true,
"typeSettings": {
"additionalResourceOptions": []
},
"jsonData": "[\r\n { \"value\": \"1\", \"label\": \"1\" },\r\n { \"value\": \"5\", \"label\": \"5\", \"selected\":true },\r\n { \"value\": \"10\", \"label\": \"10\" },\r\n { \"value\": \"15\", \"label\": \"15\" },\r\n { \"value\": \"30\", \"label\": \"30\" },\r\n { \"value\": \"45\", \"label\": \"45\" },\r\n { \"value\": \"60\", \"label\": \"60\" },\r\n { \"value\": \"90\", \"label\": \"90\" }\r\n]",
"resourceType": "microsoft.insights/components"
}
],
"style": "pills",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"name": "parameters - 2"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "\r\nF5Telemetry_AVR_CL\r\n| where hostname_s == '{HostName}'\r\n| where TimeGenerated > ago(10m)\r\n| project hostname_s, CPU=todouble(MaxCpu_s)/100, logTime= TimeGenerated\r\n| join kind=inner (\r\n F5Telemetry_system_CL \r\n | where hostname_s == '{HostName}'\r\n | where TimeGenerated > ago(10m) \r\n | project hostname_s, version_s, licenseReady_s, marketingName_s, syncMode_s, failoverStatus_s, provisioning_ltm_level_s,provisioning_gtm_level_s, provisioning_afm_level_s ,provisioning_apm_level_s, provisioning_asm_level_s, provisioning_avr_level_s\r\n) on hostname_s\r\n| project-away hostname_s1, logTime\r\n| top 1 by CPU\r\n\r\n\r\n\r\n\r\n\r\n\r\n",
"size": 4,
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "table",
"gridSettings": {
"formatters": [
{
"columnMatch": "licenseReady_s",
"formatter": 18,
"formatOptions": {
"showIcon": true,
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "yes",
"representation": "Available",
"text": "YES"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "3",
"text": "{0}{1}"
}
]
},
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal",
"useGrouping": false
}
}
},
{
"columnMatch": "failoverStatus_s",
"formatter": 18,
"formatOptions": {
"showIcon": true,
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "ACTIVE",
"representation": "Available",
"text": "Active"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "stopped",
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "provisioning_ltm_level_s",
"formatter": 18,
"formatOptions": {
"showIcon": true,
"thresholdsOptions": "colors",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "minimum",
"representation": "yellow",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "none",
"representation": "gray",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "green",
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "provisioning_gtm_level_s",
"formatter": 18,
"formatOptions": {
"showIcon": true,
"thresholdsOptions": "colors",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "minimal",
"representation": "yellow",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "none",
"representation": "gray",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "green",
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "provisioning_afm_level_s",
"formatter": 18,
"formatOptions": {
"showIcon": true,
"thresholdsOptions": "colors",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "minimum",
"representation": "yellow",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "none",
"representation": "gray",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "green",
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "provisioning_apm_level_s",
"formatter": 18,
"formatOptions": {
"showIcon": true,
"thresholdsOptions": "colors",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "minimum",
"representation": "yellow",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "none",
"representation": "gray",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "green",
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "provisioning_asm_level_s",
"formatter": 18,
"formatOptions": {
"showIcon": true,
"thresholdsOptions": "colors",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "minimum",
"representation": "yellow",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "none",
"representation": "gray",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "green",
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "provisioning_avr_level_s",
"formatter": 18,
"formatOptions": {
"showIcon": true,
"thresholdsOptions": "colors",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "minimum",
"representation": "yellow",
"text": "{0}{1}"
},
{
"operator": "==",
"thresholdValue": "none",
"representation": "gray",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "green",
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "CPU",
"formatter": 8,
"formatOptions": {
"palette": "greenRed",
"showIcon": true
},
"numberFormat": {
"unit": 1,
"options": {
"style": "decimal",
"useGrouping": false
}
}
},
{
"columnMatch": "TimeGenerated",
"formatter": 0,
"formatOptions": {
"showIcon": true,
"aggregation": "Max"
}
},
{
"columnMatch": "Licensed",
"formatter": 18,
"formatOptions": {
"showIcon": true,
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "YES",
"representation": "success",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "3",
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "LTM",
"formatter": 18,
"formatOptions": {
"showIcon": true,
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "NONE",
"representation": "disabled",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "Available",
"text": "{0}{1}"
}
]
},
"numberFormat": {
"unit": 0,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "DNS",
"formatter": 18,
"formatOptions": {
"showIcon": true,
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "NONE",
"representation": "disabled",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "success",
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "AFM",
"formatter": 18,
"formatOptions": {
"showIcon": true,
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "NONE",
"representation": "disabled",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "Available",
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "APM",
"formatter": 18,
"formatOptions": {
"showIcon": true,
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "NONE",
"representation": "disabled",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "Available",
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "ASM",
"formatter": 18,
"formatOptions": {
"showIcon": true,
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "NONE",
"representation": "disabled",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "Available",
"text": "{0}{1}"
}
]
}
},
{
"columnMatch": "AVR",
"formatter": 18,
"formatOptions": {
"showIcon": true,
"thresholdsOptions": "icons",
"thresholdsGrid": [
{
"operator": "==",
"thresholdValue": "NONE",
"representation": "disabled",
"text": "{0}{1}"
},
{
"operator": "Default",
"thresholdValue": null,
"representation": "Available",
"text": "{0}{1}"
}
]
}
}
],
"sortBy": [
{
"itemKey": "$gen_heatmap_CPU_1",
"sortOrder": 1
}
],
"labelSettings": [
{
"columnId": "hostname_s",
"label": "Host Name"
},
{
"columnId": "version_s",
"label": "Version"
},
{
"columnId": "licenseReady_s",
"label": "Licensed?"
},
{
"columnId": "marketingName_s",
"label": "Platform"
},
{
"columnId": "syncMode_s",
"label": "Mode"
},
{
"columnId": "failoverStatus_s",
"label": "Status"
},
{
"columnId": "provisioning_ltm_level_s",
"label": "LTM"
},
{
"columnId": "provisioning_gtm_level_s",
"label": "DNS"
},
{
"columnId": "provisioning_afm_level_s",
"label": "AFM"
},
{
"columnId": "provisioning_apm_level_s",
"label": "APM"
},
{
"columnId": "provisioning_asm_level_s",
"label": "ASM"
},
{
"columnId": "provisioning_avr_level_s",
"label": "AVR"
}
]
},
"sortBy": [
{
"itemKey": "$gen_heatmap_CPU_1",
"sortOrder": 1
}
]
},
"name": "query - 13"
},
{
"type": 1,
"content": {
"json": "# Processor and Memory "
},
"name": "text - 6"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "F5Telemetry_AVR_CL \n| where Entity_s == 'SystemMonitor'\n| where hostname_s == '{HostName}'\n| where TimeGenerated between ({TimeRange:start}..{TimeRange:end})\n| summarize AggregatedValue = max(todouble(MaxCpu_s))/100 by hostname_s, bin (TimeGenerated, {SampleValue}{SamplePeriod})\n",
"size": 0,
"aggregation": 2,
"title": "BIG-IP CPU % Over Time",
"timeContext": {
"durationMs": 0
},
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "timechart",
"chartSettings": {
"xAxis": "TimeGenerated",
"ySettings": {
"unit": 1,
"min": null,
"max": null
}
}
},
"customWidth": "50",
"name": "query - 2"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "F5Telemetry_AVR_CL \r\n| where Entity_s == 'CpuStat'\r\n| where hostname_s == '{HostName}'\r\n| where TimeGenerated between ({TimeRange:start}..{TimeRange:end})\r\n| summarize CPU_Usage_per_CPU_ID = max(todouble(system_s)/100) by cpu_id_s, hostname_s, bin (TimeGenerated, {SampleValue}{SamplePeriod})\r\n\r\n\r\n",
"size": 0,
"aggregation": 2,
"title": "BIG-IP CPU(%) per Core",
"timeContext": {
"durationMs": 0
},
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "timechart",
"gridSettings": {
"formatters": [
{
"columnMatch": "CPU_Usage_per_CPU_ID",
"formatter": 1,
"formatOptions": {
"showIcon": true,
"aggregation": "Average"
},
"numberFormat": {
"unit": 1,
"options": {
"style": "decimal"
}
}
}
],
"labelSettings": [
{
"columnId": "hostname_s",
"label": "Host Name"
},
{
"columnId": "cpu_id_s",
"label": "CPU ID"
},
{
"columnId": "TimeGenerated",
"label": ""
},
{
"columnId": "CPU_Usage_per_CPU_ID",
"label": "Usage (%)"
}
]
},
"chartSettings": {
"ySettings": {
"unit": 1,
"min": null,
"max": null
}
}
},
"customWidth": "50",
"name": "query - 3"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "F5Telemetry_AVR_CL \r\n| where Entity_s == 'SystemMonitor'\r\n| where hostname_s == '{HostName}'\r\n| where TimeGenerated between ({TimeRange:start}..{TimeRange:end})\r\n| summarize Memory_Usage = max(todouble(AvgMemory_s)/100) by hostname_s, bin (TimeGenerated, {SampleValue}{SamplePeriod})\r\n\r\n",
"size": 0,
"aggregation": 2,
"title": "BIG-IP Memory Utlilzation (%)",
"color": "green",
"timeContext": {
"durationMs": 0
},
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "timechart",
"chartSettings": {
"ySettings": {
"unit": 1,
"min": null,
"max": null
}
}
},
"name": "query - 10"
},
{
"type": 1,
"content": {
"json": "---\r\n# Disk Utilization"
},
"name": "text - 6 - Copy"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "\r\n F5Telemetry_system_CL\r\n| where hostname_s == '{HostName}'\r\n| project TimeGenerated, User = toint(trim(@\"%\", diskStorage__usr_Capacity_s)),UserSize = toint(diskStorage__usr_1024_blocks_s)/2097152, Shared = toint(trim(@\"%\", diskStorage__shared_Capacity_s)) ,SharedSize = toint(diskStorage__shared_1024_blocks_s)/2097152 , Var = toint(trim(@\"%\", diskStorage__var_Capacity_s)), VarSize = toint(diskStorage__var_1024_blocks_s)/2097152, AppData = toint(trim(@\"%\", diskStorage__appdata_Capacity_s)), AppDataSize = toint(diskStorage__appdata_1024_blocks_s)/2097152,Config = toint(trim(@\"%\", diskStorage__config_Capacity_s )), ConfigSize = toint(diskStorage__config_1024_blocks_s )/2097152,Dev = toint(trim(@\"%\", diskStorage__dev_Capacity_s)) , DevSize = toint(diskStorage__dev_1024_blocks_s)/2097152 , DevShm = toint(trim(@\"%\", diskStorage__dev_shm_Capacity_s)), DevShmSize = toint(diskStorage__dev_shm_1024_blocks_s)/2097152,Run = toint(trim(@\"%\", diskStorage__run_Capacity_s)),RunSize = toint(diskStorage__run_1024_blocks_s)/2097152\r\n| top 1 by TimeGenerated\r\n| project-away TimeGenerated",
"size": 4,
"aggregation": 2,
"title": "Disk Capacity(%) and Size by Volume",
"color": "green",
"timeContext": {
"durationMs": 0
},
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "table",
"gridSettings": {
"formatters": [
{
"columnMatch": "User",
"formatter": 8,
"formatOptions": {
"min": 1,
"max": 100,
"palette": "coldHot",
"showIcon": true
},
"numberFormat": {
"unit": 1,
"options": {
"style": "decimal",
"useGrouping": false
}
}
},
{
"columnMatch": "UserSize",
"formatter": 0,
"formatOptions": {
"showIcon": true
},
"numberFormat": {
"unit": 5,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "Shared",
"formatter": 8,
"formatOptions": {
"min": 1,
"max": 100,
"palette": "coldHot",
"showIcon": true
},
"numberFormat": {
"unit": 1,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "SharedSize",
"formatter": 0,
"formatOptions": {
"showIcon": true
},
"numberFormat": {
"unit": 5,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "Var",
"formatter": 8,
"formatOptions": {
"min": 1,
"max": 100,
"palette": "coldHot",
"showIcon": true
},
"numberFormat": {
"unit": 1,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "VarSize",
"formatter": 0,
"formatOptions": {
"showIcon": true
},
"numberFormat": {
"unit": 5,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "AppData",
"formatter": 8,
"formatOptions": {
"min": 1,
"max": 100,
"palette": "coldHot",
"showIcon": true
},
"numberFormat": {
"unit": 1,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "AppDataSize",
"formatter": 0,
"formatOptions": {
"showIcon": true
},
"numberFormat": {
"unit": 5,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "Config",
"formatter": 8,
"formatOptions": {
"min": 1,
"max": 100,
"palette": "coldHot",
"showIcon": true
},
"numberFormat": {
"unit": 1,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "ConfigSize",
"formatter": 0,
"formatOptions": {
"showIcon": true
},
"numberFormat": {
"unit": 5,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "Dev",
"formatter": 8,
"formatOptions": {
"min": 1,
"max": 100,
"palette": "coldHot",
"showIcon": true
},
"numberFormat": {
"unit": 1,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "DevSize",
"formatter": 0,
"formatOptions": {
"showIcon": true
},
"numberFormat": {
"unit": 5,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "DevShm",
"formatter": 8,
"formatOptions": {
"min": 1,
"max": 100,
"palette": "coldHot",
"showIcon": true
},
"numberFormat": {
"unit": 1,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "DevShmSize",
"formatter": 0,
"formatOptions": {
"showIcon": true
},
"numberFormat": {
"unit": 5,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "Run",
"formatter": 8,
"formatOptions": {
"min": 1,
"max": 100,
"palette": "coldHot",
"showIcon": true
},
"numberFormat": {
"unit": 1,
"options": {
"style": "decimal"
}
}
},
{
"columnMatch": "RunSize",
"formatter": 0,
"formatOptions": {
"showIcon": true
},
"numberFormat": {
"unit": 5,
"options": {
"style": "decimal"
}
}
}
],
"labelSettings": [
{
"columnId": "User"
},
{
"columnId": "UserSize",
"label": "User Vol"
},
{
"columnId": "Shared"
},
{
"columnId": "SharedSize",
"label": "Shared Vol"
},
{
"columnId": "Var"
},
{
"columnId": "VarSize",
"label": "Var Vol"
},
{
"columnId": "AppData"
},
{
"columnId": "AppDataSize",
"label": "AppData Vol"
},
{
"columnId": "Config"
},
{
"columnId": "ConfigSize",
"label": "Config Vol"
},
{
"columnId": "Dev"
},
{
"columnId": "DevSize",
"label": "Dev Vol"
},
{
"columnId": "DevShm"
},
{
"columnId": "DevShmSize",
"label": "DevShm Vol"
},
{
"columnId": "Run"
},
{
"columnId": "RunSize",
"label": "Run Vol"
}
]
},
"chartSettings": {
"ySettings": {
"unit": 1,
"min": null,
"max": null
}
}
},
"name": "query - 10 - Copy"
},
{
"type": 1,
"content": {
"json": "---\r\n# Connections and Throughput"
},
"name": "text - 7"
},
{
"type": 12,
"content": {
"version": "NotebookGroup/1.0",
"groupType": "editable",
"items": [
{
"type": 1,
"content": {
"json": "### Network Interface Metrics"
},
"name": "text - 15"
},
{
"type": 9,
"content": {
"version": "KqlParameterItem/1.0",
"crossComponentResources": [
"{Workspace}"
],
"parameters": [
{
"id": "69858195-8db8-4943-8263-407970f386b0",
"version": "KqlParameterItem/1.0",
"name": "Interface",
"label": "Interface Name",
"type": 2,
"isRequired": true,
"query": "F5Telemetry_AVR_CL\r\n| where hostname_s == '{HostName}'\r\n| where interface_name_s startswith '1.' or interface_name_s startswith 'mg' or interface_name_s startswith '2.'\r\n| distinct interface_name_s \r\n| order by interface_name_s asc\r\n",
"crossComponentResources": [
"{Workspace}"
],
"value": "",
"typeSettings": {
"additionalResourceOptions": []
},
"timeContext": {
"durationMs": 0
},
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
}
],
"style": "pills",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces"
},
"name": "parameters - 15"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "F5Telemetry_AVR_CL\r\n| where Entity_s in ('InterfaceTraffic', 'InterfaceHealth')\r\n| where hostname_s == '{HostName}'\r\n| where interface_name_s == '{Interface}'\r\n| where TimeGenerated between ({TimeRange:start}..{TimeRange:end})\r\n| extend drop_pkts = todouble(counters_drops_in_s) + todouble(counters_drops_out_s)\r\n| extend err_pkts = todouble(counters_errors_in_s) + todouble(counters_errors_out_s)\r\n| summarize max(toint(counters_pkts_in_s)), max(toint(counters_pkts_out_s)) , max(drop_pkts) , max(err_pkts) by interface_name_s, bin (TimeGenerated, {SampleValue}{SamplePeriod})\r\n\r\n\r\n",
"size": 0,
"aggregation": 3,
"timeContext": {
"durationMs": 0
},
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "timechart",
"tileSettings": {
"showBorder": false,
"titleContent": {
"columnMatch": "interface_name_s",
"formatter": 1
},
"leftContent": {
"columnMatch": "avg_counters_pkts_in_s",
"formatter": 12,
"formatOptions": {
"palette": "auto"
},
"numberFormat": {
"unit": 17,
"options": {
"maximumSignificantDigits": 3,
"maximumFractionDigits": 2
}
}
}
},
"chartSettings": {
"seriesLabelSettings": [
{
"seriesName": "max_counters_pkts_in_s",
"label": "Packets In"
},
{
"seriesName": "max_counters_pkts_out_s",
"label": "Packets out"
}
],
"ySettings": {
"unit": 17,
"min": null,
"max": null
}
}
},
"name": "query - 17"
}
]
},
"name": "interfaceGroup"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "F5Telemetry_AVR_CL \r\n| where tolong(transactions_s) >= 0\r\n| extend tps = tolong(transactions_s )\r\n| where notempty(pool_name_s) or Entity_s == 'DeviceTraffic'\r\n| where hostname_s == '{HostName}'\r\n| where TimeGenerated between ({TimeRange:start}..{TimeRange:end})\r\n| summarize Transactions_Per_Second = max(tps) by pool_name_s, bin (TimeGenerated,{SampleValue}{SamplePeriod})",
"size": 0,
"aggregation": 2,
"title": "Transactions per Second (TPS)",
"color": "blueDark",
"timeContext": {
"durationMs": 0
},
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "unstackedbar",
"chartSettings": {
"seriesLabelSettings": [
{
"seriesName": "<empty>",
"label": "Device Traffic",
"color": "turquoise"
}
],
"xSettings": {},
"ySettings": {}
}
},
"customWidth": "50",
"name": "query - 8"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "F5Telemetry_AVR_CL\r\n| where Entity_s == 'globalThroughput'\r\n| where hostname_s == '{HostName}'\r\n| where TimeGenerated between ({TimeRange:start}..{TimeRange:end})\r\n| summarize KBsOUT = max(todouble(bytes_out_s)/1024), KBsIN = max(todouble(bytes_in_s)/1024) by hostname_s, bin (TimeGenerated, {SampleValue}{SamplePeriod})\r\n",
"size": 0,
"aggregation": 2,
"title": "KBs In & KBs Out",
"timeContext": {
"durationMs": 0
},
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "categoricalbar"
},
"customWidth": "50",
"name": "query - 5"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "F5Telemetry_AVR_CL\r\n| where Entity_s == 'TCP'\r\n| where hostname_s == '{HostName}'\r\n| where RequestSide_s == 'Server-side'\r\n| where TimeGenerated between ({TimeRange:start}..{TimeRange:end})\r\n| summarize Connections_Opened = max(todouble(ConnStatsNumStarts_s)), Connections_Closed = max(todouble(ConnStatsNumEndings_s)) by bin (TimeGenerated, {SampleValue}{SamplePeriod})\r\n",
"size": 0,
"aggregation": 2,
"showAnnotations": true,
"title": "Server-side TCP Connections",
"timeContext": {
"durationMs": 0
},
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "timechart",
"sortBy": []
},
"customWidth": "50",
"name": "query - 4"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "F5Telemetry_AVR_CL\r\n| where Entity_s == 'TCP'\r\n| where hostname_s == '{HostName}'\r\n| where RequestSide_s == 'Client-side'\r\n| where TimeGenerated between ({TimeRange:start}..{TimeRange:end})\r\n| summarize Connections_Opened = max(todouble(ConnStatsNumStarts_s)), Connections_Closed = max(todouble(ConnStatsNumEndings_s)) by bin (TimeGenerated, {SampleValue}{SamplePeriod})\r\n",
"size": 0,
"aggregation": 2,
"showAnnotations": true,
"title": "Client side TCP Connections",
"timeContext": {
"durationMs": 0
},
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "timechart",
"chartSettings": {
"seriesLabelSettings": [
{
"seriesName": "Connections_Opened",
"color": "turquoise"
},
{
"color": "pink"
}
]
}
},
"customWidth": "50",
"name": "query - 4 - Copy"
},
{
"type": 1,
"content": {
"json": "---"
},
"name": "text - 15"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "F5Telemetry_AVR_CL \r\n| where Entity_s == 'TCP'\r\n| where hostname_s == '{HostName}'\r\n| where RequestSide_s == 'Server-side'\r\n| where TimeGenerated between ({TimeRange:start}..{TimeRange:end})\r\n| summarize PacketsSent = avg(toint(PktsSent_s)), PacketsReceived = avg(toint(PktsRecv_s)), PacketsLost = avg(toint(PktsLost_s)) by bin (TimeGenerated, {SampleValue}{SamplePeriod})\r\n\r\n\r\n",
"size": 0,
"aggregation": 2,
"title": "Server-side TCP Packets Sent, Received, Lost",
"timeContext": {
"durationMs": 0
},
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "timechart",
"chartSettings": {
"seriesLabelSettings": [
{
"seriesName": "PacketsSent",
"color": "blueDark"
},
{
"seriesName": "PacketsReceived",
"color": "green"
},
{
"seriesName": "PacketsLost",
"color": "redBright"
}
]
}
},
"customWidth": "50",
"name": "query - 11"
},
{
"type": 3,
"content": {
"version": "KqlItem/1.0",
"query": "F5Telemetry_AVR_CL \r\n| where Entity_s == 'TCP'\r\n| where hostname_s == '{HostName}'\r\n| where TimeGenerated between ({TimeRange:start}..{TimeRange:end})\r\n| where RequestSide_s == 'Client-side'\r\n| summarize PacketsSent = max(toint(PktsSent_s)), PacketsReceived = max(toint(PktsRecv_s)), PacketsLost = max(toint(PktsLost_s)) by bin (TimeGenerated, {SampleValue}{SamplePeriod})\r\n| render areachart\r\n\r\n",
"size": 0,
"aggregation": 2,
"title": "Client-side TCP Packets Sent, Received, Lost",
"timeContext": {
"durationMs": 0
},
"timeContextFromParameter": "TimeRange",
"queryType": 0,
"resourceType": "microsoft.operationalinsights/workspaces",
"crossComponentResources": [
"{Workspace}"
],
"visualization": "timechart",
"chartSettings": {
"seriesLabelSettings": [
{
"seriesName": "PacketsSent",
"color": "blueDark"
},
{
"seriesName": "PacketsReceived",
"color": "green"
},
{
"seriesName": "PacketsLost",
"color": "redBright"
}
]
}
},
"customWidth": "50",
"name": "query - 11 - Copy"
}
],
"fromTemplateId": "sentinel-F5BIGIPSystemMetrics",
"$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}